push-backend-to-ghcr.yaml

name: Push backend container image to ghcr.io

on:
  workflow_call:
    inputs:
      package:
        required: true
        type: string

jobs:
  push-backend-to-ghcr:
    permissions:
      contents: read
      packages: write
      id-token: write

    runs-on: ubuntu-latest

    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
        with:
          # Required by flakes
          fetch-depth: 0

      - name: Import secrets from Vault
        uses: hashicorp/vault-action@v3.0.0
        id: secrets
        with:
          url: https://vault.hackworth-corp.com
          path: "github-actions"
          role: primer-app-workflow-ghcr
          method: jwt
          secrets: |
            secret/data/cachix/hackworthltd-private/github-workflows token | CACHIX_AUTH_TOKEN ;

      - name: Install & configure Nix
        uses: cachix/install-nix-action@v26
        with:
          extra_nix_config: |
            trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hackworthltd.cachix.org-1:0JTCI0qDo2J+tonOalrSQP3yRNleN6bQucJ05yDltRI= hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ= loony-tools:pr9m4BkM/5/eSTZlkQyRt57Jz7OMBxNSUiMC4FkcNfk=
            substituters = https://cache.nixos.org?priority=10 https://hackworthltd.cachix.org?priority=30 https://cache.iog.io?priority=40 https://cache.zw3rk.com?priority=50

      - name: Configure Cachix for private Hackworth Ltd cache
        uses: cachix/cachix-action@v14
        with:
          name: hackworthltd-private
          authToken: '${{ env.CACHIX_AUTH_TOKEN }}'
          skipPush: true

        # Note: if this Nix derivation hasn't been built yet, it will
        # kick off a Primer Nix build on a GitHub runner, which isn't
        # ideal. (It will work, eventually, but it'll be very slow.)
        # Therefore, make sure you don't deploy `primer-service` pins
        # before they've been built by the `primer` repo.
      - name: Fetch `primer-service` Docker image
        run: |
          nix build -L .#packages.x86_64-linux.primer-service-docker-image

      - name: Authenticate to ghcr.io
        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Push image to ghcr.io
        shell: bash
        run: |
          docker load < result
          IMAGE=$(docker image list -f reference=primer-service --format "{{.Repository}}:{{.Tag}}")
          TAG=$(docker image list -f reference=primer-service --format "{{.Tag}}")
          echo "Loaded image: ${IMAGE}"
          NAME="${{ inputs.package }}:$TAG"
          docker tag "$IMAGE" "$NAME"
          echo "Pushing image to ghcr.io: ${NAME}"
          docker push "$NAME"
          echo "Image pushed."